提出RAG安全攻击与防御的分类框架，系统梳理威胁路径与防护机制。
Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
- 构建SLOT四维分类法，明确攻击面、防御层、目标与对象
- 揭示知识访问管道中两大结构性错配问题
- 适合关注RAG安全、模型鲁棒性研究者参考
检索增强生成（RAG）通过引入外部知识扩展大语言模型能力，但其知识访问路径也带来新型安全风险，现有研究常将这些风险与大模型固有缺陷混淆。本文将安全RAG定义为保障外部知识访问的安全性，提出SLOT分类框架，从四个维度系统组织文献：攻击面（S）、防御层（L）、目标（O，基于CIA三性）、目标类型（T），涵盖从单个已知查询（T1）到查询分布上的目标主张操纵（T2）。将攻击、防御、修复与评估映射至六阶段知识访问流程，揭示两个结构性错配。最后讨论未来方向：更真实的目标设定、无盲点防御、自适应评估、更强机密性，以及多模态与智能体式RAG的评估方法。相关论文清单见：https://github.com/TreeAI-Lab/Awesome-RAG-Security。
原文摘要 · Abstract (English)
Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws. We frame secure RAG as securing external knowledge access and organize the literature with SLOT, a taxonomy along four axes: the attack Surface (S) where an adversary acts, the defense Layer (L) that controls the same point, the Objective (O) it breaks following the CIA properties, and the Target (T) it pursues, from a single known query (T1) to target-claim manipulation across a query distribution (T2). Mapping attacks, defenses, remediation, and evaluation onto a six-stage knowledge-access pipeline, we expose two structural mismatches. Finally, we discuss directions for more realistic targets, no-blind-spot and adaptively evaluated defenses, stronger confidentiality, and evaluation for multimodal and agentic RAG. The curated paper list for RAG security is in: https://github.com/TreeAI-Lab/Awesome-RAG-Security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。